All Apps and Add-ons

getsnow configuration

pkeller
Contributor

Been trying to configure the getsnow app. A couple of questions.

  • is it supported on a search head cluster?
  • when i create a [production] stanza including 'user' and 'password' settings, is the clear-text password supposed to get encyrpted?
  • getsnow.log gets created but there is never any data written.
  • |getsnow table="" doesn't seem to return any data at all.
  • the 'getsnow' search also returns a number of errors from our indexer pool, which seems odd. Is getsnow required to be installed on the indexing layer as well?

Thank you

0 Karma
1 Solution

pkeller
Contributor

bmacias84 provided the solution to my question. - thank you

View solution in original post

0 Karma

pkeller
Contributor

bmacias84 provided the solution to my question. - thank you

0 Karma

bmacias84
Champion

Hello @pkeller,

I am working on a new version of the app. Which simplifies things. The new version will contain three new command snowincident, snowtask, snowuser.

snowincident - pulls incidents by users or assignment group looks up sys_id.
snowtask - pulls tasks by users or assignment group looks up sys_id.
snowuser - pulls user information, assigned assets, and last 10 incidents for user.

  • is it supported on a search head cluster? Yes it does work in SHC

  • when i create a [production] stanza including 'user' and 'password' settings, is the clear-text password supposed to get encyrpted? No, it made it easier to implement is Search Head Pooling and in SHC.

  • getsnow.log gets created but there is never any data written. Never got around to finishes logging

  • |getsnow table="" doesn't seem to return any data at all. It should attempt to pull data from the incident table. The user is still required to have read permission to any ServiceNow table you query.

  • the 'getsnow' search also returns a number of errors from our indexer pool, which seems odd. Is getsnow required to be installed on the indexing layer as well? In the version of the SDK i used and depending on the version of Splunk their is a bug where Splunk ignores local=true flag which tells the search processor this is a Search head only command. The fix is to set @Configuration(local=True) in the code and in the config file.

pkeller
Contributor

Thank you ... that resolved my issue ... I also had to change another line in getsnow.py

from:
sysparam_query = '?sysparm_display_value=all%s%s%s' % ('&sysparm_query=', '^'.join(self.filters.split(',')), time_range) if self.filters else 'sysparm_limit=1'

to:
sysparam_query = '?sysparm_display_value=all%s%s%s' % ('&sysparm_query=', '^'.join(self.filters.split(',')), time_range) if self.filters else ‘?sysparm_limit=1’

I'm now getting the json output returned in the UI.

Thanks very much.

0 Karma

bmacias84
Champion

If you would like to play around with the latest version. you can download it at https://github.com/httpstergeek/getsnow. Its about 2 weeks from being published in the app store.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...